Skip to content
GRIMOIRY

Set a spending alarm

$ grim infra:aws-budget --limit=50 --email=ops@example.com

AWS bills after the fact, and nothing in a new account tells you the bill is growing. A forgotten instance or a bucket that turned popular shows up weeks later as a number. Run grim infra:aws-budget first on any account you are about to create things in: it costs nothing and turns that number into four emails along the way.

It is an alarm and not a brake. When the limit is crossed AWS writes to you and keeps everything running.

Usage

$ grim infra:aws-budget                                                # asks for the limit and the address
$ grim infra:aws-budget --limit=50 --email=ops@example.com             # no questions but the confirmations
$ grim infra:aws-budget --limit=200 --email=ops@example.com,cfo@example.com

Run it from anywhere. It needs the aws CLI, terraform and working AWS credentials; grim infra:doctor checks them. The limit is whole US dollars per calendar month, for the entire account.

Arguments and options

Set a monthly AWS spend cap with email notifications at 50/80/100% + forecast alert

Usage

grim infra:aws-budget [--limit LIMIT] [--email EMAIL] [--name NAME] [--profile PROFILE] [--dry-run] [--force]

Options

Option Description
--limit=LIMIT Monthly limit in USD (e.g. 50)
--email=EMAIL Notification email (comma-separated for multiple)
--name=NAME Budget name (default: grim-monthly-cap)
--profile=PROFILE AWS CLI profile to use
--dry-run Show plan only, do not provision
--force Allow re-using an existing state directory

What it actually does

  1. Shows the AWS identity and asks whether to create resources in that account. The default answer is no.
  2. Takes the limit and the addresses. Several addresses are separated by commas, and each one is validated. The budget is named grim-monthly-cap unless you pass --name.
  3. Prints the plan: account, budget name, limit, subscribers and the four notifications. With --dry-run it stops here.
  4. Runs Terraform in ~/.grim/infra/budget-<account>/ after a second confirmation. One AWS Budget of type cost is created, and nothing else.
  5. Records it under aws_resources in ~/.grim/servers.json as budget-<account>, with the name, limit, addresses, account and profile.

The four emails

Threshold Measured on Meaning
50 percent Actual spend Early warning
80 percent Actual spend Close to the limit
100 percent Actual spend The limit is reached
100 percent AWS's forecast for the month The month is heading above the limit, before it gets there

The budget counts raw spend: credits and refunds are not subtracted, tax and support are included. Unlike the alarms of grim infra:aws-alarms, these addresses need no confirmation link. The command says so when it finishes.

Pitfalls

The budget stops nothing

No instance is shut down and no bucket is locked at 100 percent. The emails are the whole feature. If you need a hard stop, that is a Budget Action, set up by hand in the AWS console.

One budget per account

A budget state dir already exists for budget-123456789012. means this account already has one made by grim. To change the limit or the addresses, run grim infra:destroy budget-123456789012 and create it again.

After it finishes

The plan states the cost as $0/month. The budget shows in grim infra:list with its limit, and the first mail arrives when actual spend passes half of it.

$ grim infra:list

grim infra:destroy with the id budget-<account> removes it, and the notifications with it.

grim infra:aws-ec2

Raise a server on AWS

Create one EC2 instance with a static address, a firewall and your SSH key in your AWS account, then hand it to grim server:setup.

grim infra:aws-cloudtrail

Keep an account audit trail

Turn on a CloudTrail trail that records API activity in every region of the account into a locked-down S3 bucket, at a level of detail you pick from four presets.

grim infra:aws-alarms

Set a watch on a server

Attach two CloudWatch alarms to an EC2 instance, for sustained high CPU and for failed status checks, and have AWS mail you when either fires.

grim infra:list

Survey what runs on AWS

List every server and AWS resource grim has created, with a monthly cost estimate for each and the ids that infra:destroy takes.

grim infra:destroy

Unmake what grim made

Remove a server or AWS resource that grim created, after checking the account and making you type its name, and stop it from being billed.